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LEAK, U.S. CISTRICT COURT 
ALEXANDRIA, VIRGINIA 
KANE [SUSU 


IN THE UNITED STATES DISTRICT COURT FOR THE 


EASTERN DISTRICT OF VIRGINIA 


Alexandria Division 


UNITED STATES OF AMERICA ) Criminal No. 1:18-cr-19 M 132771 / 
) 
v. ) 
) 
SEAN ANDREW DUNCAN, ) 
) 
Defendant. ) 

STATEMENT OF FACTS 


The United States and the defendant, SEAN ANDREW DUNCAN agree that at trial, the 
United States would have proved the following facts beyond a reasonable doubt with admissible 
and credible evidence: 

k; On December 29, 2017, in Sterling, Virginia, in the Eastern District of Virginia, the 
defendant, SEAN ANDREW DUNCAN, unlawfully and knowingly altered, destroyed, mutilated, 
concealed, and covered up tangible objects with the intent to impede and obstruct the investigation 
of a matter within the jurisdiction of an agency of the United States, or in contemplation of such 
matter; to wit: DUNCAN altered, destroyed, mutilated, concealed, and covered up a thumb drive 
and memory chip with the intent to impede and obstruct an investigation of the Federal Bureau of 
Investigation into criminal violations of United States law. 

2, In or about December 2017, within Fairfax County, in the Eastern District of 
Virginia, the defendant, SEAN ANDREW DUNCAN, knowingly and unlawfully received a visual 
depiction of a minor engaging in sexually explicit conduct using any means and facility of 
interstate and foreign commerce, and that had been shipped and transported in and affecting 


interstate and foreign commerce, and which contained materials which had been shipped and 
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transported, by any means including by computer; to wit: DUNCAN received by means of a 
Samsung Galaxy Note 3 smartphone (“the Samsung Galaxy”) connected to the Internet still images 
depicting minor and prepubescent children engaging in sexually explicit conduct, including actual 
and simulated intercourse, masturbation, and the lascivious exhibition of the genitals and pubic 
area. 

A. The Counterterrorism Investigation 

3. On or about October 15, 2004, the United States Secretary of State designated al- 
Qaeda in Iraq (“AQI”), then known as Jam ‘at al Tawhid wa’al-Jihad, as a Foreign Terrorist 
Organization (“FTO”) under Section 219 of the Immigration and Nationality Act and as a Specially 
Designated Global Terrorist entity under section 1(b) of Executive Order 13224. On or about 
May 15, 2014, the Secretary of State amended the designation of AQI as a FTO under Section 219 
of the Immigration and Nationality Act and as a Specially Designated Global Terrorist entity under 
section 1(b) of Executive Order 13224 to add the alias Islamic State of Iraq and the Levant (“ISIL”) 
as its primary name. The Secretary also added the following aliases to the FTO listing: The 
Islamic State of Iraq and al-Sham (“ISIS”—which is how the FTO will be referenced herein), the 
Islamic State of Iraq and Syria, ad-Dawla al-Islamiyya fi al-Iraq wa-sh-Sham, Daesh, Dawla al 
Islamiya, and E Establishment for Media Production. On September 21, 2015, the 
Secretary added to the FTO listing the aliases Islamic State, ISIL, and ISIS. To date, ISIS remains 
a designated FTO. 

4. An unnamed co-conspirator (hereinafter “UCC™”), is in the custody of a foreign 
government for actively planning to travel to join ISIS. Duncan was one of UCC's U.S.-based 
contacts who had expressed an interest in joining ISIS, conducting an attack in his homeland (the 


United States), and how to construct homemade bombs. Duncan and UCC primarily spoke on 
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encrypted mobile messaging applications. UCC communicated with Duncan on an encrypted 
mobile messaging account (“MM1”). 

5. UCC first became acquainted with Duncan on social media in January 2015 when 
Duncan sent her a friend request. UCC and Duncan initially communicated through social media 
but subsequently exchanged phone numbers and communicated on encrypted mobile messaging 
applications. 

6. Duncan shared news articles with UCC from an ISIS news outlet known as Amaq 
News. During their communications in early 2015, Duncan expressed agreement with ISIS 
spokesman Abu Mohammad Al-Adnani’s statement that Muslims should be striking their own 
homelands. When UCC asked Duncan directly if he supported ISIS, he replied that he did. In 
addition, UCC made it clear to Duncan from the start of their relationship in the beginning of 2015 
that she would not communicate with him unless he was “pro-ISIS.” UCC was looking for a 
“Salafi or an ISIS supporter” to marry and live with in Syria. She believed she would reap 
“heavenly rewards” if she married an ISIS fighter who died in battle. 

7. In February 2015, UCC asked Duncan if he intended to go to Syria. Duncan told 
UCC that he wanted to make “hijrah” to Syria and that he wanted UCC to go with him to Syria. 
In order for Duncan and UCC to go to Syria together, Duncan proposed marriage to UCC. 
Duncan’s proposal occurred over an encrypted mobile messaging application. Duncan told UCC 
that after they were married, he wanted to plan their trip to Syria. Duncan wanted to come to 
UCC’s country to propose to UCC in person, but she said it was too soon. As a result of UCC 
rejecting Duncan’s offer of marriage, the two broke contact in or around March 2015. 

8. Before they broke contact, UCC was upset at work due to non-Muslim women 


wearing shorts that exposed their bodies. UCC told Duncan via an encrypted mobile messaging 
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application she was upset with the way these women dressed and she wanted to do something 
about it. UCC told FBI investigators that Duncan replied with a link to a website, and a message 
saying she could “try this.” UCC said that the link was to an article titled, “How to build a bomb 
in the kitchen of your Mom” from Inspire magazine, and contained pictures and instructions on 
how to make weapons and bombs. 

9. In 2015, Duncan posted ISIS material on his Facebook page, including the black 
flag used by ISIS. In 2015, Duncan was introduced by a female ISIS supporter to a male ISIS 
member in Raqqah, Syria, through an encrypted mobile messaging app. Through encrypted 
mobile messaging applications and Facebook, Duncan often communicated with ISIS supporters 
in Syria and elsewhere. Duncan discussed with an ISIS member in Raqqa, Syria, potentially 
traveling to Syria and bringing his family. 

10. In November 2015, Duncan created a Twitter account with the Twitter handle 
@Dawlahtullslaam. The phrase “Dawlahtul Isla[a]m” is an Arabic phrase that roughly translates 
to “The Islamic State.” 

11. In January 2016, Duncan asked UCC if she still wanted to go to Syria and to be his 
second wife. UCC asked Duncan if his current wife would be okay with UCC coming with them 
to Syria. Duncan stated that his wife would have to be okay with it. UCC did not agree to go, and 
the two broke contact again. 

12. Duncan and his wife booked a flight to Istanbul, Turkey, departing from 
Washington Dulles International Airport, on February 26, 2016. They were scheduled to depart 
Turkey for Bangladesh on March 4, 2016, and return to the United States on March 20, 2016. On 


February 26, 2016, Duncan and his wife departed the United States for Turkey. On February 27, 
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2016, they were denied entry into Turkey, and returned to the United States. Upon their return, 
they were interviewed by the FBI. 

13. Onor about August 6, 2016 and September 14, 2016, Duncan took multiple pictures 
and/or videos of himself holding up a single index finger in a manner that signified support for 
ISIS. 

14. On or about October 12, 2016, Duncan viewed and reacted to a Facebook post about 
martyrdom. The post quoted al-Bidaayah wa’l-Nihaayah, and included the statement “the only 
thing standing between you and Paradise is your being killed.” The post also included a quote that 
“if they kill you for the truth, you will be a shaheed (martyr)”. At another time, Duncan conducted 
a Google search on his phone that contained the phrase “I want to die.” 

15. | In December 2016, Duncan, utilizing an encrypted mobile messaging account, re- 
initiated contact with UCC. Duncan told UCC that he had come back from Turkey, from where 
he and his wife had been sent back to the United States. Duncan said he thought the FBI was 
monitoring him, but would not elaborate on why he was deported or why the FBI was monitoring 
him. Duncan said he did not want to implicate himself and that his wife could keep secrets. 
Duncan stated that his wife knew what to say when questioned by authorities. 

16. | Between March 2017 and June 2017, Duncan used his smartphone to conduct 
hundreds of internet searches for ISIS-related materials; weapons; terrorists; body armor; 
surveillance; defense tactics; leaked directory of government employees, watchlist terms, watchlist 
explanations and leaked FBI data on terrorist encounters in the USA. For example, on or about 
April 1, 2017, Duncan used his phone to take photos andlor videos of tactical gear and a rifle 
carrying case in what appears to be a firearms or military surplus store. Duncan took pictures of 


other tactical gear including what appears to be assault rifles. Duncan also searched the name Abu 
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Bakr al-Baghdadi, Amir Khattab, and Chechen jihad and took several screenshots of the resulting 
images of al-Baghdadi and Osama Bin Laden, and a picture of soldiers with a black flag in the 
background. 

17. On or around April 21, 2017, Duncan used his phone to search phrases and topics 
including bicep armor; Pennsylvania body armor laws; Maryland body armor laws; Virginia body 
armor laws; full body armor suit; mass body armor laws; Hoplite Army tactical body armor and 
armor accessories; operator's assault vest; and military bulletproof vest. 

18. In or about May 2017, Duncan used his phone to search for information about 
firearms. On or about May 23, 2017, Duncan searched the phrase Manchester Attack and viewed 
articles related to the terrorist attack conducted by Salman Abedi. 

19. On August 11, 2017, an FBI undercover employee (UCE) posing as UCC, 
contacted Duncan, who was using an encrypted mobile messaging account (“MM2”). UCE told 
Duncan that “she” had been arrested by foreign authorities. Immediately after being told this, 
Duncan created secure chats and self-destruct timers to destroy the content of his messages with 
UCE. UCE told Duncan that “she” intended to make “hijrah.” Duncan stated, “Hm, you know 
a fence Someone to take you, and is it safe in Iraq.” Later, UCE asked Duncan if he had a contact 
in Syria, to which Duncan responded, “No a couple have been marytred (sic).” 

20. On August 20, 2017, UCE told Duncan that “she” was in contact with an individual 
in Libya who was attempting to facilitate “her” travel to Libya. UCE told Duncan that the Libyan 
contact was asking various vetting questions prior to assisting UCE. UCE told Duncan that “her” 
Libyan contact was asking strange questions, such as UCE’s blood type and family contact. UCE 


then asked Duncan if he (Duncan) and his wife were asked similar questions when they tried to 
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travel to Syria. Duncan stated, “they won’t ask that.” Duncan further stated, “I didnt (sic) go for 
that Just honeymoon.” 

21. Later in the conversation, however, UCE asked Duncan what to do about “her” 
contact in Libya. Duncan recommended that UCE “. . . lie to him.” Duncan stated he had never 
dealt with unnecessary vetting by “contacts” and that he had “always had referrals.” ISIS uses a 
referral system to recruit new members, and Duncan’s statement meant that Duncan did not get 
asked questions by his contacts because he had “referrals” who could give them “tazkiyah.” 
Tazkiyah is a recommendation from a Jihadi Shaykh from their homeland or a Mujahid already in 
the land of Jihad. It is a generally given by an existing member of ISIS to show an individual is 
trustworthy. 

22. In October 2017, a foreign government arrested one of its nationals ("Recruiter 1") 
for inciting rebellion. Recruiter 1 is an ISIS recruiter who is suspected of drawing foreign fighters 
from around the world to Recruiter 1°s home country using social media. Recruiter 1 was married 
to two jihadis with connections to ISIS, one of whom is dead and the other of whom was arrested 
for extremism by his home country. Recruiter 1 posted a message on an electronic messaging 
application soliciting local and foreign Muslims to help terrorists fight government troops in 
Recruiter 1’s home country. 

23. Recruiter 1 recorded the names and telephone numbers of individuals who had 
requested to join her Telegram, Facebook, or other social media and/or communication application 
groups. Recruiter 1’s notes included a handwritten name appearing to be “Sean Ibn Gary 
Duncan,” associated with a phone number used by Duncan and the user name associated with 


MM1. In Arabic, "Ibn" means "son of". Sean Andrew Duncan's father's name is Gary Duncan. 
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24. In December 2017, one of Duncan’s smartphones contained hundreds of images of 
beheadings of adult men, ISIS fighters and propaganda videos promoting ISIS extremism. It also 
contained images of what appeared to be bloodied, deceased children located in a conflict zone 
similar to Syria or Iraq. 

B. Child Pornography 

25. In December 2017, Duncan possessed a Samsung Galaxy smartphone. Contained 
on the Samsung Galaxy smartphone were images of pre-pubescent minors that appeared to be 
engaged in sexually explicit conduct with adult males. Other images on the phone were of pre- 
pubescent minors posed to expose their genitalia in a sexual manner. Several of the images of 
child pornography were screen shots that Duncan had taken of websites containing child 
pornography that he had visited. The pre-pubescent minors in the photos were as young as 
infants, and the total number of images was in the thousands. | 

26. | One image on the Samsung Galaxy phone consisted of Duncan's hand, exposing 
the genitalia of one of Duncan's infant relatives in a sexual manner. In June and July 2017, that 
infant relative resided in the same home as Duncan and his wife in Reston, Virginia. 

27. | On several of Duncan’s phones and electronic devices in December 2017, were 
thousands of videos and images of children and women that Duncan took in a voyeuristic manner 
of their rear ends. Several of the videos and images i taken in public venues such as stores, 
metros, parks, and restaurants. The women and children include strangers and family members. 

C. Obstruction of Justice 

28. On December 19, 2017, this Court (Buchanan, M.J.) authorized searches including 
that of Duncan’s residence on Courtyard Square, in Sterling, Virginia, for evidence of attempts to 


provide material support to ISIS, in violation of 18 U.S.C. § 2339B, as well as false statements, in 
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violation of 18 U.S.C. § 1001. Among the items authorized for seizure in the search was 
information involving travel or attempts to travel overseas; communications with members of 
foreign terrorist groups, or other information identifying support for or research related to a foreign 
terrorist group. 

29. On December 29, 2017, FBI agents executed the search warrant at Duncan’s 
residence. The agents knocked on the door, identified themselves as FBI, and announced that 
they were there to execute a search warrant. Receiving no response, the agents knocked and 
announced their presence again, but received no response again. The agents then forcibly opened 
the door, and again identified themselves as FBI, and that they were there to execute a search 
warrant. 

30. Moments before the FBI agents entered the residence through the front door, 
Duncan ran out the back door, barefoot, and with something clenched in his fist. FBI agents 
guarding the back door yelled at Duncan to stop. Before stopping, Duncan threw a plastic baggie 
over the heads of the agents. 

31. FBlagents recovered the baggie thrown by Duncan. The baggie was a clear plastic 
Ziploc bag, containing a memory chip stored within a thumb drive that had been snapped into 
pieces, and placed in a liquid substance that produced frothy white bubbles. Upon searching 
Duncan, agents recovered a broken casing for a thumb drive from Duncan’s pants pocket. The 
liquid substance was a cleaning solution. 

32. Duncan fled from the house with the baggie and the memory chip and the broken 
thumb drive in order to conceal those items from the FBI agents that Duncan knew were about to 
search his house. Further, the thumb drive was snapped in pieces because Duncan altered, 


destroyed, and mutilated it in order to impede and obstruct the FBI’s investigation of him. The 
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memory chip and broken thumb drive was contained in a baggie containing a liquid substance 
because Duncan altered, destroyed, and mutilated it in order to impede and obstruct the FBI’s 
investigation of him. Duncan was arrested that same day for attempting to obstruct justice. 

33. The liquid in the bag was bleach or a cleaning solution that contained chlorine. 
The fragments in the baggie were the remnants of a memory chip and circuit board from a USB 
flash drive. Due to the extensive damage to the device, no data has yet been recovered. 

34. From the Alexandria Detention Center on January 13, 2018, Duncan spoke by 
telephone with his friend "WB." During the call, WB said that WB was scheduled to speak with 
the FBI about Duncan, and that WB would tell the FBI that "you absolutely spoke to somebody 
from ISIS. You know, ISIS was actively trying to recruit you. We both know this, and they know 
this." A few minutes later in the same call, Duncan told WB that "[a]ctually, about our mutual 
friend, they don’t seem to know about that," and that Duncan was trying to keep it that way. 

35. From the Alexandria Detention Center on January 14, 2018, Duncan spoke by 
telephone with his father. Duncan told his father to instruct WB not to "put forth something" that 
the FBI did not already know, and repeatedly told his father to remind WB that the mutual friend 
that WB had with Duncan was Allah. In fact, Duncan and WB both had spoken with a member of 
ISIS, and Duncan was attempting to get Duncan's father to instruct WB to refrain from mentioning 
to the FBI that both Duncan and WB had spoken with that member of ISIS. 

36. This statement of facts includes those facts necessary to support the plea agreement 


between the defendant and the United States. It does not include each and every fact known to 
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the defendant or to the United States, and it is not intended to be a full enumeration of all of the 
facts surrounding the defendant’s case. 
Si. The actions of the defendant, as recounted above, were in all respects knowing and 
deliberate, and were not committed by mistake, accident, or other innocent reason. 
Respectfully submitted, 


Tracy Doherty-McCormick 
Acting United States Attorney 


By: 


Colleen E. Garcia 
Gordon D. Kromberg 
Assistant United States Attorneys 
After consulting with my attorney and pursuant to the plea agreement entered into this day 
between the defendant, SEAN ANDREW DUNCAN, and the United States, I hereby stipulate that 


the above Statement of Facts is true and accurate, and that had the matter proceeded to trial, the 


United States would have proved the same beyond a reasonable doubt. 


þ (ha DUNCAN 


I am SEAN ANDREW DUNCAN's attorney. I have carefully reviewed the above 


Statement of Facts with him. To my knowledge, his decision to stipulate to these facts is an 


/ abeth Mullin 


Assistant Federal Public Defender 
Attorney for SEAN ANDREW DUNCAN 


informed and voluntary one. 


